CVE-2022-25962

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-25962
All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://security.snyk.io/vuln/SNYK-JS-VAGRANTJS-3175614 Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-VAGRANTJS-3175614 Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-VAGRANTJS-3175614 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vagrant.js_project:vagrant.js:*:*:*:*:*:node.js:*:*
History

01 Apr 2025, 15:15

Type Values Removed Values Added
References (MISC) https://security.snyk.io/vuln/SNYK-JS-VAGRANTJS-3175614 - Third Party Advisory () https://security.snyk.io/vuln/SNYK-JS-VAGRANTJS-3175614 - Third Party Advisory

07 Nov 2023, 03:44

Type Values Removed Values Added
Summary All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization. All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.

08 Aug 2023, 14:21

Type Values Removed Values Added
CWE CWE-77 NVD-CWE-Other
Information

Published : 2023-01-26 21:15

Updated : 2025-04-01 15:15

NVD link : CVE-2022-25962

Mitre link : CVE-2022-25962

JSON object : View

Products Affected

vagrant.js_project

  • vagrant.js
CWE
NVD-CWE-Other